NewApp Digest
search bot

stealer malware

JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers
Winsage
November 25, 2025

JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers

Cybersecurity experts have identified a new campaign that combines ClickFix tactics with counterfeit adult websites to trick users into executing harmful commands under the guise of a "critical" Windows security update. This campaign uses fake adult sites, including clones of popular platforms, as phishing mechanisms, increasing psychological pressure on victims. ClickFix-style attacks have risen significantly, accounting for 47% of all attacks, according to Microsoft data. The campaign features convincing fake Windows update screens that take over the user's screen and instruct them to execute commands that initiate malware infections. The attack begins when users are redirected to a fake adult site, where they encounter an "urgent security update." The counterfeit Windows Update screen is created using HTML and JavaScript, and it attempts to prevent users from escaping the alert. The initial command executed is an MSHTA payload that retrieves a PowerShell script from a remote server, which is designed to deliver multiple payloads, including various types of malware. The downloaded PowerShell script employs obfuscation techniques and seeks to elevate privileges, potentially allowing attackers to deploy remote access trojans (RATs) that connect to command-and-control servers. The campaign has been linked to other malware execution chains that also utilize ClickFix lures. Security researchers recommend enhancing defenses through employee training and disabling the Windows Run box to mitigate risks associated with these attacks.
LastPass: GitHub hosts atomic stealer malware campaign
Tech Optimizer
September 25, 2025

LastPass: GitHub hosts atomic stealer malware campaign

Cybersecurity researchers have identified a malware campaign targeting Mac users, with attackers creating fraudulent GitHub pages to distribute an infostealer known as Atomic Stealer (AMOS). The campaign was first detected on September 16, 2025, involving pages that falsely claimed to offer LastPass software. Users are misled into clicking links that redirect them to malicious sites, where they are prompted to execute a command that installs malware on their systems. The attackers impersonate reputable companies and use multiple GitHub usernames to avoid detection, employing SEO techniques to rank their malicious links higher in search results. LastPass is actively monitoring the situation and working on takedowns. Users are advised to download software only from official sources, avoid executing commands from unknown sites, keep software updated, use antivirus protection, enable regular backups, and be cautious of unexpected links and emails.
Windows 11 24H2 Security Update Causes SSD/HDD Failures and Potential Data Corruption
Winsage
August 18, 2025

Windows 11 24H2 Security Update Causes SSD/HDD Failures and Potential Data Corruption

A significant security update from Microsoft, Windows 11 24H2 (KB5063878), is causing issues for users, making SSDs and HDDs inaccessible and potentially corrupting user data. Users have reported installation failures with error code 0x80240069, and despite a hotfix, the update has led to storage drives disappearing from the Windows environment, particularly during large sequential write operations. Recovery attempts are often unsuccessful, putting user files at risk. Microsoft has not provided an official fix, and users are advised to avoid the update and ensure routine data backups. Unplugging and reconnecting the affected drive may temporarily restore visibility but does not guarantee data safety.
Counterfeit Minecraft mods deliver malware
AppWizard
June 22, 2025

Counterfeit Minecraft mods deliver malware

A series of sophisticated cyberattacks using ACR Stealer-based Amatera Stealer malware have been executed as part of ClearFake web injection campaigns between April and May. These campaigns utilize advanced techniques, including EtherHiding to obscure malicious activities, targeting smart contracts on the Binance Smart Chain for unauthorized access, and ClickFix Exploitation to manipulate user interactions for executing harmful scripts.
Microsoft says Lumma password stealer malware found on 394,000 Windows PCs
Winsage
May 22, 2025

Microsoft says Lumma password stealer malware found on 394,000 Windows PCs

Microsoft, in collaboration with law enforcement, has taken legal action against the Lumma malware operation, which has affected over 394,000 Windows PCs globally, particularly in Brazil, Europe, and the United States. A federal court authorized the seizure of 2,300 domains used as command and control servers for Lumma, and the Justice Department confiscated five additional domains related to its infrastructure. Lumma is primarily spread through questionable games or cracked applications and extracts sensitive information such as logins, passwords, credit card details, and cryptocurrency wallets, which is then sold to other cybercriminals. Lumma also facilitates the deployment of additional malware, including ransomware, and has been linked to significant cyberattacks on major tech companies like PowerSchool and Snowflake, resulting in substantial data theft.
Search